Telefonaktiebolaget Lm Ericsson (publ)

Ntt Docomo, Inc.

Equinix, Inc.

Sun Microsystems, Inc.

James Kempf

Nanjangud Chandrasekhara Swamy Narendra

Bengt Johansson

Sten Pettersson

Sambit Nayak

Anshu Shukla

Tord K Nilsson

Craig B Gentry

Ramesh Mishra

Ravi Kumar Jain

Toshiro Kawahara

Howard Green

Stephan Baucke

Mallik Tatipamula

Harald Lüning

Kumar Balachandran

Ulas C Kozat

Neda Beheshti-Zavareh

Oleg Berzin

Muhammad Mukarram Bin Tariq

Mukesh Thakur

Rafael Lean De Vera Ansay

Harald Luning

Ying Zhang

Ravi Manghirmalani

Heikki Mahkonen

Catalin Meirosu

Jian Chen

Zoltán Turányi

Jonathan Trostle

Michael L Powell

Tomas Mecklin

Hosei Matsuoka

Wolfgang John

Imam Sheikh

Chunyan Fu

Mikael Persson

Hulya Seferoglu

M Reha Civanlar

Chen Xi

Elisa Bellagamba

Rodney Martin Elder

Malini R Minasandram

Svetlana Radosavac

Milan Basnet

Pontus Skoldstrom

Muhammad Mukarran Bin Tariq

Joacim HALÉN

Nanjangud Chandrasekharaswamy Narendra

Sten Rune Pettersson

Bengt E Johansson

A method and a spectrum owner system are described. The spectrum owner system records, in a distributed ledger network, a list of spectrum resources licensed from a regulatory authority system to the spectrum owner system. The spectrum owner system receives an authorization request for a spectrum allocation of spectrum resources, where the spectrum allocation includes at least a desired interval of time for usage of the spectrum resources by a radio access network of a spectrum renter, a desired location for usage of the spectrum resources by the radio access network, and additional characteristics of the spectrum resources. The spectrum owner system negotiates agreement terms for the desired spectrum allocation; and records, in the distributed ledger network, a hash of the spectrum allocation, where the spectrum allocation enables the radio access network of the spectrum renter to provide radio access services to wireless network devices.

Spectrum allocation using a distributed ledger network

A method and system for service image deployment in a cloud computing system based on distributed ledger technology are described. A first signed message including a request to authorize installation of a service image, a service image identifier, a service installer account identifier, and one or more hashes of the service image is received. Responsive to determining, based on the service installer account identifier and a distributed ledger, that the service installer is authorized to install a service image identified with the service image identifier in a cloud computing system: the one or more hashes of the service image are recorded in a list of valid service images of the distributed ledger; and a first message is transmitted to the service installer. The message includes a first service installation token and the service image identifier, that cause the service installer to install the service image in the cloud computing system.

Method and system for service image deployment in a cloud computing system based on distributed ledger technology

A first data center receives a request, from a tenant, to access a first service. Responsive to determining that the tenant is not associated with a delegation contract, the first data center records a delegation contract for the tenant. A second data center receives a request, from the tenant, to access a second service, where the second data center is physically separate from the first data center. Responsive to determining that the tenant is associated with the delegation contract recorded in the blockchain database, the second data center causes an update of the delegation contract in the blockchain database; causes the second service to provide access to the tenant; transmits, to the tenant, a confirmation that the second service can be accessed, and transmits an update to the first data center indicating that the delegation contract has been updated to include a second service offer.

Method and apparatus for managing cloud services using smart contracts and blockchains in a federation of cloud providers

In general, this disclosure describes an IoT access control exchange for IoT devices. Verifiable credentials can be generated and used to grant access to IoT devices definitively identified using a Decentralized Identifier (DID). DIDs for IoT devices are registered by the IoT exchange hub acting as an Identity Hub. An organization interested in obtaining data from a collection of devices, the IoT Access Customer, contacts the IoT device owner agent via their mutual agents and obtains a verifiable credential with a request for access. The access request is submitted to the IoT exchange hub. The IoT exchange hub either enforces the access request itself if the devices do not have enough resources or submits the verifiable credential with the access request to the devices for them to enforce access. The IoT access customer agent, IoT device owner agent, and IoT exchange hub similarly identify themselves and prove authentication using DIDs.

Controlling access to internet of things devices using verifiable credentials

A method is implemented by one or more network devices to identify an originating point of failure in a composite service executed in a cloud computing environment. The execution of the composite service includes execution of a plurality of atomic services in an ordered sequence, where for each atomic service that is executed, an execution trace for that atomic service is stored in a blockchain to form an ordered sequence of execution traces, where the execution trace for a given atomic service is signed using the private key associated with that atomic service and analyzing one or more of the ordered sequence of execution traces to determine which of the plurality of atomic services originated the failure, where each execution trace that is analyzed is authenticated using the public key that corresponds to the private key associated with the atomic service that generated that execution trace.

Method and apparatus for secure and verifiable composite service execution and fault management on blockchain

This disclosure describes techniques for verifying virtualized network functions (VNFs) using Decentralized Identifiers (DIDs). For example, a system includes an orchestrator configured to obtain, using a Decentralized Identifier (DID) that is associated with a virtualized network function (VNF) image for a VNF, a DID document associated with the DID, verify, based on the DID document associated with the DID, the VNF image, and deploy the VNF image as a VNF instance on a Network Functions Virtualization infrastructure (NFVi). The system also includes one or more consensus networks that store the DID document associated with the VNF image in a distributed ledger.

Virtualized network functions verification using decentralized identifiers

Methods and systems for implementing a distributed blockchain transaction processing element in a data center are described. A call to a function is received. The call for the function is dispatched to a first runtime environment of a first server. Code is fetched from the blockchain database. The code is executed in the first runtime environment resulting in a blockchain transaction. A copy of the blockchain transaction is written in a storage medium that is locally accessible by the first server. The blockchain transaction is added to a first block. A consensus mechanism is used to determine whether the first block is to be added to the blockchain database; and responsive to determining that the first block is to be added to the blockchain database, the first block is caused to be stored in a persistent storage as part of the blockchain database.

Method and apparatus for implementing a distributed blockchain transaction processing element in a datacenter

A method and a network node for managing access, by a device, to a blockchain. The network node receives, a first request for creation of a first account. The first request includes information relating to a user of the device and a first hash value. The network node creates, based on the information and the first hash value, the first account on the blockchain, whereby a first address is obtained. The network node receives, a second request for recovering account information of the first account. The second request includes the first address of the first account, a source value from which the first hash value is derived and a second address of a second account. The network node generates a second hash value based on the source value. The network node initiates transfer of the account information of the first account to the second account.

Method and network node for managing access to a blockchain

A method and a network device in a cloud computing system, including a first blockchain component that is one of a plurality of blockchain components forming a blockchain system, of dynamic discovery of another blockchain component of the blockchain system are described. A multicast address including a multicast group identifier is generated. The multicast group identifier is generated at least in part based on a genesis block identifier that uniquely identifies a blockchain serviced by the blockchain system. The network device joins a multicast group identified by the multicast group identifier; and transmits a message destined to the multicast address, where the message includes a request for a unicast address of another component of the blockchain system.

Method and apparatus for dynamic discovery of a blockchain component in a cloud computing system

Techniques for a secure device registration and software update using Decentralized Identifiers (DIDs). For example, a method includes sending, by a device and to a data store, a request for a software update published by a software publisher, wherein the request includes a verifiable credential for the device including a DID of the device; receiving, by the device and from the data store, a verifiable credential for the software update, wherein the verifiable credential includes a DID of the software publisher; determining, by the device, whether the software update is newer than software on the device; obtaining, by the device, the software update from the software publisher from a location specified by the verifiable credential; verifying, by the device, the software update based on the verifiable credential; and in response to verifying the software update based on the verifiable credential, installing, by the device, the software update.

Decentralized identifiers for securing device registration and software updates

Methods and systems for authorizing the access of a service are described. A server is operative to receive a request to subscribe to a service. The server is to receive from the requestor a selected service offer from the set of service offers, where the selected service offer is cryptographically signed with the private key of the requestor and the private key of the service. The server is further to record a delegation contract into a blockchain database, where the delegation contract includes an identification of the service, an identification of the requestor, and the service offer that is cryptographically signed with the private keys of the requestor and the service. The server is to transmit, to the requestor, a confirmation that the service can be accessed based on the selected service offer; and transmit to the service the delegation contract causing the service to provide access to the requestor.

Method and apparatus for managing service access authorization using smart contracts

Methods and systems are disclosed for managing cloud services using smart contracts to facilitate various functions, such as tenant login, tenant enrollment, service registration, tenant usage charging, tenant usage tracking, tenant quota management, and tenant rights revocation. The proposed techniques allow tenant and service accounts to be represented as smart contracts, and for services to delegate authorization for bundles of service attributes to tenants and other services, for which the tenants and services are then charged. The business logic is implemented on a permissioned, distributed ledger (e.g., a private blockchain) and therefore is easily customized for specific classes of tenants and services.

Method and apparatus for managing cloud services using smart contracts and blockchains

Mechanisms for path continuity determination in an aggregate flow environment. An ingress node and a downstream node for which a path continuity check is desired are determined. The ingress node devolves, from an aggregate flow entry, one or more microflows that comprise packets which are destined for the downstream node. The downstream node is directed to generate corresponding microflows. Each microflow is associated with a continuity set identifier and has one or more timers, such as an idle timer and/or a hard timeout timer. Upon timeout of one of the timers, the ingress node and the downstream node send a microflow termination message that contains the continuity set identifier to a controller node. The controller node determines a path continuity status between the ingress node and the downstream node based on a receipt of one or more microflow termination messages from the ingress node and the downstream node.

Path continuity determination in an aggregate flow environment

A method implements a control plane of an evolved packet core (EPC) of a long term evolution (LTE) network in a cloud computing system. A cloud manager monitors resource utilization of each control plane module and the control plane traffic handled by each control plane module. The cloud manager detects a threshold level of resource utilization or traffic load for one of the plurality of control plane modules of the EPC. A new control plane module is initialized as a separate virtual machine by the cloud manager in response to detecting the threshold level. The new control plane module signals the plurality of network elements in the data plane to establish flow rules and actions to establish differential routing of flows in the data plane using the control protocol, wherein flow matches are encoded using an extensible match structure in which the flow match is encoded as a type-length-value (TLV).

Implementing EPC in a cloud computer with openflow data plane

Growing community of inventors

Mountain View, CA, United States of America

James Kempf